search

apache / datasketches-memory

High performance native memory access for Java.
https://datasketches.apache.org
Apache License 2.0
118 stars 27 forks source link

No array bounds checking if user calls /memory/internal/BaseWritableMemoryImpl. #194

Closed leerho closed 1 month ago

leerho commented 1 month ago

The class BaseWritableMemoryImpl is in the /internal/ package and not considered part of the user public API. Nonetheless, it is declared pubic because it needs to be accessed from some of the user public API classes (without having to resort to reflection).

Nonetheless, if a user happens to call the method WritableMemory wrapHeapArray(Object array, long offsetBytes, long lengthBytes, boolean, ByteOrder, MemoryRequestServer) and offsetBytes + lengthBytes > array.length(), the method will create a region longer than the given array, which could lead to downstream errors.

This is fixed with version 3.0.0.

leerho commented 1 month ago

Version 3.0.0 is released. This issue is closed.